Chat Control 2.0: what mandatory client-side scanning means for your stack

What happened

The EU is once again close to a Council vote on the Child Sexual Abuse Regulation (CSAR), colloquially known as Chat Control 2.0. The fightchatcontrol.eu explainer that hit #1 on Hacker News lays out the two-part legislative arc clearly: Chat Control 1.0 is the 2021 derogation from the ePrivacy Directive that lets providers *voluntarily* scan unencrypted communications for CSAM. It expires and gets renewed on a rolling basis. Chat Control 2.0 is the successor regulation that would make that scanning mandatory, extend it to interpersonal messaging services, and — the part that matters to anyone building on E2E — require detection *before* encryption happens on the client.

The mechanism is called client-side scanning (CSS). Every image, video, and (in earlier drafts) URL you send would be hashed and compared against a database maintained by an EU Centre, on your device, before it enters the encrypted tunnel. If the hash matches, or if an on-device classifier flags "unknown CSAM," the content and metadata are shipped to authorities. The regulation has been kicked between the Council and Parliament since 2022; the current Danish Council presidency has pushed a compromise text back onto the agenda for this autumn.

Signal's president Meredith Whittaker has said publicly that Signal will leave the EU market rather than implement client-side scanning; Threema has said the same; WhatsApp's Will Cathcart has signaled the same posture. That's not posturing — it's the only coherent engineering answer, because a scanner sitting inside the client is functionally indistinguishable from a backdoor regardless of what the surrounding legal text calls it.

Why it matters

The cryptographic community settled this question in 2021, when Apple proposed on-device CSAM scanning for iCloud Photos and then withdrew it after a joint paper from Abelson, Anderson, Rivest, Schneier, and eleven other cryptographers — "Bugs in Our Pockets: The Risks of Client-Side Scanning" — argued that CSS is architecturally incompatible with the security guarantees users are told they have. The paper's core claim was blunt: you cannot build a scanner that only ever detects one narrow class of content. Once the pipeline exists, the hash list is a policy question, and policy in 27 member states plus a permanent EU Centre is not a hard problem to widen.

The Chat Control debate is the first serious real-world test of that paper's thesis. The Commission's own Legal Service reportedly warned the proposal likely violates Articles 7 and 8 of the Charter of Fundamental Rights. The European Data Protection Board and European Data Protection Supervisor issued a joint opinion in 2022 calling the general scanning approach "disproportionate." Multiple member states — Germany, Austria, Poland, and the Netherlands at various points — have opposed the mandatory-scanning text. Belgium, France, and Ireland have supported it. The reason the file keeps coming back is that qualified-majority arithmetic in the Council is close, and each rotating presidency gets one more swing at it.

The practitioner-facing part is the false-positive rate. Independent estimates from the Swiss federal police and from academic reviews put current perceptual-hash false-positive rates at around 1 in a few thousand for adversarial inputs — meaning on a service with hundreds of millions of daily messages, you generate hundreds of thousands of erroneous reports per day, each one a human moderator opening someone else's private photos. NCMEC in the US, working with voluntary reports from Meta and Google, already flags on the order of 30M+ items per year; the actionable rate is a small fraction of that. Scale the input by mandating scanning across all EU messaging, and the review pipeline collapses under its own weight before you catch a single new perpetrator the existing voluntary regime would have missed.

The unspoken corollary: if the hash database is on device, the database itself becomes an intelligence target — and the client-side scanner becomes the highest-value exploit surface any nation-state adversary has ever been handed on a plate.

What this means for your stack

If you ship a consumer messaging product with E2E, you already know. But the regulation as drafted covers "number-independent interpersonal communications services" — which is a phrase broad enough to sweep in the DM feature in your SaaS app, the customer-support chat widget on your marketing site, the collaboration channel in your dev tool, and any federated protocol server (Matrix, XMPP) whose operator happens to be an EU resident. The threshold is not "WhatsApp-scale." It's "do people use it to talk to each other."

Concretely, three things are worth doing now, in this order. One: audit whether the messaging surfaces in your product would fall under the regulation's scope. The current text carves out enterprise-internal communications but the line between "internal" and "interpersonal" is exactly the kind of ambiguity that gets resolved against you two years later. Two: if you're building on Matrix, Signal Protocol, MLS, or rolling your own E2E, understand that the compliance path under the current text is not "encrypt harder." It's a client-side hook — either you ship one or someone in the app-store review process ships one for you. Three: the geographic-partitioning play (EU users get one binary, everyone else gets another) has been floated but is operationally miserable and, per the EU Centre's draft mandate, may not even be legal, since it would require detection wherever an EU user *receives* content.

Betting on "the regulation will get watered down in trilogue" is a valid strategy exactly once — and it doesn't survive the second round.

Looking ahead

The cleanest path forward, if you build in this space, is to make the client-side-scanning question a first-class item in your threat model rather than a compliance afterthought. That means writing down, now, what you would do the day the regulation passes — do you ship the hook, do you geoblock, do you pull out of the market, do you fork? The engineering decision is downstream of a values decision, and values decisions made under a two-week deadline tend to be the ones you regret. Signal wrote its answer down years ago. Most product teams have not, and that is the gap the next Council vote will expose.